From: Daniel Salzman <daniel.salzman@nic.cz>
Date: Tue, 2 Feb 2021 10:15:51 +0000 (+0100)
Subject: knotd: reduce required RLIMIT_MEMLOCK value
X-Git-Tag: v3.1.0~240^2~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e84d2bc27e3fd2e227e877e697d97a8f0d76b4b4;p=thirdparty%2Fknot-dns.git

knotd: reduce required RLIMIT_MEMLOCK value
---

diff --git a/src/knot/server/server.c b/src/knot/server/server.c
index b4bf25d979..bc7707c619 100644
--- a/src/knot/server/server.c
+++ b/src/knot/server/server.c
@@ -486,15 +486,22 @@ static int configure_sockets(conf_t *conf, server_t *s)
 	conf_val_t lisxdp_val = conf_get(conf, C_SRV, C_LISTEN_XDP);
 	conf_val_t rundir_val = conf_get(conf, C_SRV, C_RUNDIR);
 
+#ifdef ENABLE_XDP
 	if (lisxdp_val.code == KNOT_EOK) {
-		struct rlimit no_limit = { RLIM_INFINITY, RLIM_INFINITY };
-		int ret = setrlimit(RLIMIT_MEMLOCK, &no_limit);
-		if (ret != 0) {
-			log_error("failed to increase RLIMIT_MEMLOCK (%s)",
-			          knot_strerror(errno));
-			return KNOT_ESYSTEM;
+		struct rlimit min_limit = { KNOT_XDP_MIN_MEMLOCK, KNOT_XDP_MIN_MEMLOCK };
+		struct rlimit cur_limit = { 0 };
+		if (getrlimit(RLIMIT_MEMLOCK, &cur_limit) != 0 ||
+		    cur_limit.rlim_cur < min_limit.rlim_cur ||
+		    cur_limit.rlim_max < min_limit.rlim_max) {
+			int ret = setrlimit(RLIMIT_MEMLOCK, &min_limit);
+			if (ret != 0) {
+				log_error("failed to increase RLIMIT_MEMLOCK (%s)",
+				          knot_strerror(errno));
+				return KNOT_ESYSTEM;
+			}
 		}
 	}
+#endif
 
 	size_t real_nifs = 0;
 	size_t nifs = conf_val_count(&listen_val) + conf_val_count(&lisxdp_val);